python-pocketbase

maintainer enihcam · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds a Python SDK from the official PyPI source tarball with a proper checksum; the pip install in check() is only used in an isolated venv to verify the built wheel imports correctly, not to run arbitrary remote code, though using pip inside check() is slightly unorthodox for AUR packaging.

Triggered rules

LOW pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums. Severity reduced: python-* packages routinely use pip.

PKGBUILD:24 test-env/bin/pip install installer dist/*.whl --quiet

LOW AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is LOW (confidence 70%): The package builds a Python SDK from the official PyPI source tarball with a proper checksum; the pip install in check() is only used in an isolated venv to verify the built wheel imports correctly, not to run arbitrary remote code, though using pip inside check() is slightly unorthodox for AUR packaging.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Youcef NAFA <youcef.nafa at gmail>
    
      2
    
      3_name=pocketbase
    
      4pkgname=python-${_name}
    
      5pkgver=0.17.3
    
      6pkgrel=1
    
      7pkgdesc="PocketBase SDK for Python"
    
      8arch=('any')
    
      9url="https://github.com/vaphes/pocketbase"
    
      10license=('MIT')
    
      11depends=('python' 'python-httpx')
    
      12makedepends=('python-uv-build' 'python-build' 'python-installer' 'python-wheel')
    
      13source=("https://files.pythonhosted.org/packages/source/${_name::1}/${_name}/${_name}-$pkgver.tar.gz")
    
      14sha256sums=('11de4d412fddc98e72030fa78b395972eaa646c36c06aa2506d8a26cd251cb00')
    
      15
    
      16build() {
    
      17    cd "${srcdir}"/${_name}-${pkgver}
    
      18    python -m build --wheel --no-isolation
    
      19}
    
      20
    
      21check() {
    
      22  cd "${srcdir}"/${_name}-${pkgver}
    
      23  python -m venv test-env
    
      24  test-env/bin/pip install installer dist/*.whl --quiet
    
      25  test-env/bin/python -c "from pocketbase import PocketBase; print('import OK')"
    
      26}
    
      27
    
      28package() {
    
      29  cd "${srcdir}"/${_name}-${pkgver}
    
      30  python -m installer --destdir="$pkgdir" dist/*.whl
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3